CVE-2026-12562

CVE-2026-12562 affects Toptech Systems RCU II+ and Multiload II+ devices. A network-accessible port runs a Target Communications Framework (TCF) service that does not require authentication, exposing a debug interface that grants full root access to the embedded Linux environment. An unauthentica...

CVE-2026-12562 Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...

CVE-2026-62845

Kamaji (Hosted Control Plane Manager for Kubernetes) is affected by a SQL injection in the PostgreSQL and MySQL datastore drivers. The root cause is that DataStoreUsername and DataStoreSchema are interpolated into SQL statements via fmt.Sprintf without escaping identifiers, and these fields have ...

CVE-2026-56428

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

CVE-2026-56428

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

CVE-2026-56428

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

CVE-2026-56428

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

CVE-2026-56428

CVE-2026-56428 affects the SSH service on BSH ELP (Electronic Platform) modules . The root cause is a default, insecure, non-revocable SSH public key stored in the firmware’s authorized_keys, allowing an attacker with the corresponding private key to bypass authentication and achieve root-level a...

EUVD-2026-51108

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorizedkeys file for the root user. An attacker in possession of the...

CVE-2026-44106

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44099

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44096

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44095

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44093

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44106

CVE-2026-44106 describes a local privilege escalation in the init-script for user-applications (init.d /etc/init.d/user-applications). A low-privileged local user can run arbitrary commands as root, leading to full system compromise. The available documents provide CVSS v3.1/4.0 data (high severi...

EUVD-2026-51040

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44106 Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44099

CVE-2026-44099 is a local privilege escalation. Connected sources describe a vulnerability enabling a low-privilege local user to gain root privileges via manipulation of system configuration, specifically cited as Local Privilege Escalation via pppd password injection. The NVD entry reiterates t...

CVE-2026-44099 Local Privilege Escalation via pppd password injection

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44099

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...